CVE-2018-19574

Vulnerability

GitLab CE/EE versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1 are vulnerable to a reflected XSS in the OAuth authorization page [1]. The redirect_uri parameter is not properly validated, allowing arbitrary protocols including javascript: and data: URIs [1].

Exploitation

An attacker can create an OAuth application with a malicious redirect URI such as javascript://%0aalert(document.domain) and then trick a victim into visiting a crafted URL /oauth/authorize?client_id=APP_ID&redirect_uri=...&response_type=code&state=A [1]. The victim needs to click the application name on the authorization page to trigger the JavaScript execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser in the context of the GitLab domain, leading to potential information disclosure, session hijacking, or actions performed on behalf of the victim [1].

Mitigation

GitLab has addressed this issue by preventing data, vbscript, and javascript protocols in the redirect URI validation [1]. Users should upgrade to patched versions: 11.3.11, 11.4.8, or 11.5.1 and later [1]. There is no known workaround besides upgrading.